AI agent inventory gaps are breaking enterprise governance models

At a glance

What this is: Onyx reports that AI agent inventories routinely undercount live deployments, with first scans often revealing a two to five times larger population than the customer believed existed.

Why it matters: IAM, IGA, and AI governance teams need continuous discovery because undisclosed agents can carry real access, make decisions, and escape existing approval and review processes.

Context

AI agent discovery is the practice of finding and attributing agentic systems that are already operating in enterprise environments, including those embedded in licensed software, created by engineering teams, or activated by users inside SaaS platforms. The governance problem is not that these systems are always unauthorized. It is that they often sit outside the central inventory that security, IAM, and risk teams rely on to make access and accountability decisions.

Onyx's account shows why the first week of deployment matters. A submitted inventory can be a starting point, but it is not a trustworthy baseline when agents arrive through product updates, local automation, or hidden platform features. In identity terms, this is a visibility and attribution problem that affects NHI governance, AI governance, and operational control at the same time.

The article's central claim is that inventory accuracy is no longer an audit exercise that can wait. If the enterprise cannot identify what is running, who owns it, and what it can reach, then approval, review, and remediation processes are already operating on stale assumptions.

Key questions

Q: What breaks when AI systems are deployed without a complete inventory?

A: Governance breaks first, then auditability. If teams cannot identify every model, dependency, and owner, they cannot assign risk tiers, apply the right controls, or prove compliance when regulators ask. The result is shadow AI: systems that process data and influence decisions outside the governance perimeter, often for months.

Q: Why do AI agents create a governance risk even when the software was legitimately licensed?

A: Because legitimacy of procurement does not equal legitimacy of runtime access. An agent can arrive through a vendor feature, a workflow automation script, or user activation without ever passing through central identity review. The risk is hidden expansion of the access surface, not purchase fraud. Governance fails when licensing is mistaken for authorisation.

Q: How do security teams know if an AI inventory is actually working?

A: An AI inventory is working when it is used to make real decisions about approval, access, risk rating, and review cadence. If the record is current, linked to runtime evidence, and triggers action when systems drift, it is functioning as a governance control rather than a static catalog.

Q: When should organisations add continuous controls for AI agents?

A: Organisations should add continuous controls as soon as an agent can select tools, act across systems, or delegate to other non-human identities. Those capabilities create runtime drift and delegation risk that periodic certification cannot see fast enough. Continuous oversight becomes necessary once the agent can change its own action path.

Technical breakdown

Why AI agent inventory breaks at the source

Agent discovery fails when organisations treat agents as a procurement event instead of a runtime identity problem. Some agents are embedded in software already licensed, so no separate request ever reaches central governance. Others are configured by engineering teams or individual users inside SaaS tools, which means they exist operationally before they exist administratively. That is why the first query against the environment often produces a materially larger result set than the approved inventory. The technical issue is not just missed counting. It is missing control points for ownership, entitlement mapping, and scope review.

Practical implication: build discovery around live environment queries, not submitted spreadsheets or purchase records.

Identity attribution for AI agents and shared credentials

AI agents create an attribution problem because actions are often logged against the credential they hold rather than the system that made the decision. If an agent uses a borrowed or shared human credential, the audit trail can falsely imply person-level action. That breaks incident reconstruction, access review, and accountability reporting. In multi-agent setups, the problem compounds because delegation chains can obscure which actor actually initiated the action. For governance, this is not a logging nuisance. It is a boundary failure between identity, intent, and execution.

Practical implication: require agent-specific attribution before letting an agent reach production data or operational systems.

Continuous AI visibility versus one-time inventory audits

A week-one inventory is only useful if it feeds an always-on governance process. AI environments change quickly because agents are added through product updates, workflow automation, and user-led experimentation. A static report decays almost immediately and gives teams the illusion of control without the operating model behind it. The right control pattern looks more like identity governance or vulnerability management than project documentation. That means ownership, escalation, and recurring review cycles rather than a one-off discovery milestone.

Practical implication: treat agent inventory as a continuous control with recurring reconciliation, not a finite onboarding task.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent inventory is now a governance control, not an audit artifact: The article shows that discovery gaps are structural, not exceptional, because agents enter through licensed software, engineering workflows, and user activation paths that traditional inventories do not capture. That means the old assumption that the inventory is the source of truth has already failed. Practitioners should treat discovery as a runtime governance control, not a documentation exercise.

Identity attribution for AI agents is the next blind spot: When an agent acts through a shared or inherited credential, logs can point to a human even when the decision and execution came from software. That breaks accountability, incident reconstruction, and access review logic at the same time. The implication is that agent identity must be separable from human identity in operational records before scale makes the problem irrecoverable.

AI visibility debt is the right name for the problem: Enterprises are accumulating a gap between what they believe exists and what is actually running, and that gap grows whenever inventories are updated only after procurement or review events. This is a named governance debt, not a tooling quirk. The practitioner conclusion is simple: if continuous visibility is absent, every other control is built on stale context.

Week-one discovery is where governance assumptions are tested: The first scan exposes whether ownership, authorisation, and review are defined around actual runtime behaviour or around internal process memory. Mature programmes will fail closed on unknown agents; immature programmes will discover them only after they have already inherited data access. The field should stop treating discovery as a prelude and start treating it as the operating condition for AI governance.

Inventory accuracy now determines blast radius: If an agent is invisible, it is also unauthorised in practical terms even when it was technically enabled by a valid product path. That means the organisation cannot size risk, assign ownership, or set remediation priority correctly. The practitioner conclusion is that governance quality is now limited by the quality of discovery, not by the elegance of policy language.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

AI visibility debt: This article captures a growing governance debt created when organisations assume their inventory is current after a single onboarding scan. That assumption fails as soon as agents can be embedded in products, activated by users, or created by engineering outside formal request paths. Continuous discovery is becoming a baseline control for AI governance, not a specialist add-on.

The operational lesson is that discovery must be tied to ownership and attribution, not just enumeration. If an agent cannot be linked to a responsible business owner and an explicit access scope, then approval, review, and incident response will all start from stale context rather than verified state.

For practitioners

• Run live discovery against the environment Query SaaS platforms, engineering environments, and licensed software directly so the inventory reflects running agents, not submitted records.
• Separate agent attribution from human credentials Map each agent to its own identity record, ownership, and purpose so logs do not falsely attribute agent action to a person.
• Establish a week-one reconciliation process Compare the approved inventory against runtime findings immediately after onboarding and resolve any unexplained gaps before operational handoff.
• Review high-risk agents first Prioritise any publicly reachable agent, HR data access, or broad operational scope for containment and authorisation review before expanding the rest of the programme.
• Move inventory to a continuous control model Assign an owner, escalation path, and recurring review cadence so discovery remains current as agents are added, reconfigured, or embedded in new products.

Key takeaways

• AI agent inventories are frequently incomplete because agents enter through product features, engineering workflows, and user-driven activation paths that traditional governance never sees.
• The governance risk is not just miscounting. It is the loss of attribution, ownership, and scope control over runtime identities that can already reach enterprise systems.
• Continuous discovery and identity attribution are the controls that change the problem from hidden exposure to governable state.

Key terms

• AI agent inventory: An AI agent inventory is a complete record of autonomous or semi-autonomous software entities, including their permissions, tools, and reachable resources. It is a governance baseline because teams cannot review, restrict, or remediate agent access until they know exactly what the agent estate contains.
• Identity Attribution: Identity attribution is the ability to determine which entity performed an action and under what authority. For AI agents, it requires separate identities, structured logs, and traceable decision records so investigations can distinguish human intent from autonomous execution.
• Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.